myTUM breach exposes central passwords and lets attackers reach TUMonline
The Technical University of Munich says attackers stole central login passwords through myTUM and used an administrator's credentials to attack TUMonline. The university suspended affected accounts and took TUMonline offline. Reset instructions apply to all TUM IDs as a precaution.
- Disclosed
- Nov 6, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- People who signed in to myTUM; staff and students may also have personal data exposed. All TUM ID holders must follow the reset guidance.
- TUM · credential theft · campus IT
- In the wild
- Yes
- TUM confirmed password theft and use of admin credentials against TUMonline.
What happened
TUM says unknown attackers stole central login passwords from people who had signed in to myTUM. They obtained a TUMonline system administrator’s credentials and used them to attack the separate campus management system. TUM did not disclose the initial entry mechanism, the relevant login period or a victim count. TUM says MFA protected accounts in this incident; its reset requirement still covers all TUM IDs.
Beyond the confirmed password theft, TUM says names, home addresses and birth dates may have been accessed, as may work addresses and phone numbers for employees, and student IDs, degree programs and semesters of study where applicable. Its review of the mostly logged TUMonline access has not indicated exposure of grades or applications so far. That assessment is provisional.
TUMonline login remained unavailable in the November 7 reset instructions; a reset does not itself restore access. The L4 rating reflects confirmed password theft across the affected myTUM population and use of an administrator’s credentials against a central system. It does not quantify victims or imply that every category of personal data was taken.
Crime-scene timeline
Nov 3, 07:55 UTC
Start of the TUMonline service interruption as recorded by TUM IT
The status entry gives the start of the interruption; it does not establish the initial intrusion or public disclosure time.
Nov 5, 10:04 UTC
TUM restricts EduVPN to users with MFA already configured
EduVPN requires a passkey or a time-based one-time password together with a valid TUM password.
Nov 6, 2026
TUM publicly confirms password theft and the attack on TUMonline
TUM suspended affected accounts and took TUMonline offline. It reported the incident to the Bavarian State Commissioner for Data Protection and filed a criminal complaint.
Nov 6, 18:09 UTC
Microsoft 365 access is blocked for TUM accounts without existing MFA
Those users need an alternative reset route.
Nov 7, 12:00 UTC
TUM updates reset instructions for all TUM IDs
The instructions apply even to people who did not use myTUM. A password changed since the published November 5 cutoff remains valid under current guidance.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- TUM incident disclosurePrimaryConfirms password theft, administrator credential use, possible personal-data scope and containment.
- TUM IT reset instructionsPrimaryAll TUM IDs, November 5 cutoff, official reset methods, service restrictions and phishing guidance.
- TUMonline status noticePrimaryRecords the service interruption start and links to the official reset procedures.
- TUM EduVPN status noticePrimaryEduVPN requires previously enrolled MFA, with a passkey or TOTP and a valid password.
- TUM Microsoft 365 status noticePrimaryConfirms login is blocked for users who had not already set up MFA.